® 



Europaisches Patentamt 
European Patent Office 
Office europeen des brevets 

EUROPEAN 



® Application number: 90107108.4 
@ Date of filing: 12.04.90 

® Priority: 25.05.89 US 357174 

@ Date of publication of application: 
28.11.90 Bulletin 90/48 

(S) Designated Contracting States: 

ATBECHDEDKFRGBITLINLSE 



0 Publication number: 

PATENT APPLICATION 

© intciAH04N 7/16 



0 399 200 

A2 



® Applicant: GENERAL INSTRUMENT 
CORPORATION 
767 Fifth Avenue 
New York New York 10153(US) 

@ Inventor: Kauffman, Marc W. 

420 Franklin Avenue .^,..ox 
Cheltenham, Pennsylvania 19012(US) 
Inventor: Miller, Michael R- 
98 Onieda Avenue ,„^„,Mev 
Moorestown, New Jersey 08057(US) 

® Representative: Hoeger, Stellrecht & Partner 
Uhlandstrasse 14 c 
D-7000 Stuttgart 1{DE) 



® Functionally modifiable cable television converter system. 



© A cable television converter with remotely mod, - 
k*ie functionality receives firmware downloaded 
over a cable television network. The mtegnty of the 
Srmware is verfied and if valid, the ^'^-^-f^ 
Sed to provide one or more converter funfons. If 
TtlL is invalid, default operation software 
conta^^d in ROM is executed instead of the f.rm- 
warfto return the converter to baseline operation. In 
^nTelodiment. the converter includes a frequency 
ag e data receiver to receive control '"S mctjons on 
a first data channel and firmware on a second data 
Channel The receiver is forced back to the frs 
^uchanne if a successful firmware download does not 
S oocur on the second channel within a predetem^med 
time period. The firmware is continuously transm-t- 
2 ed in Tort segments, and the converter can con- 
SS^ to Jeceive'segments until al, the segments o a 
-.designated firmware package have been success 
g?ully downloaded, unless the predetermined time l.m- 
CO it expires sooner. 
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FUNCTIONALLY MODIFIABLE CABLE TELEVISION CONVERTER SYSTEM 



BACKGROUND OF THE INVENTION 

The present invention relates to cable televi- 
sion apparatus, and more particularly to a converter 
with remotely modifiable functionality provided bv 
downloadable firmware. 

Cable television converters are currently avail- 
able that allow a cable system operator to remotely 
contro subscriber service authorizations from a 
central 'headend" site. These units, which are 
commonly referred to as "addressable converters", 
allow the cable system operator to control access 

signal from the headend to individual converters 
located at subscribers' homes. The authorization 
signals are carried on the cable television system 
and enable individual subscribers to view programs 
that they pay an additional fee for. In operation the 
control signals typically enable the converter to 
descramble the premium channels for viewing by 
the subscriber. " 

Other addressable systems currently available 
allow a limited set of operational parameters to be 
downloaded to a converter from the headend Such 
operational parameters include, for example, in- 
formation that maps displayed channels to tuned 
channels, time-out periods, barker channel (s) the 
converter output channel, the tem^inal configura- 
- tion, and enable/disable functions for subscriber 
features such as remote hand-held control, parental 
con rol, favorite channel recall, volume control, and 
the like. The current state of the art is to download 
configuration information for a set of features that 
have been predetermined at the time of manufac- 
ture or installation of the cable television converter 

nm™^'^ °' ^"^'^ ^ is the Model 

DPV7200 addressable converter manufactured bv 
he Jerrold Division of General Instrument Corpora- 
tion, Hatboro, Pennsylvania, U.S.A. 

Other systems with downloadable data capabil- 
ities are also known. U.S. Patent 4,054,91 1 to 
Fletcher, ef al. relates to an information retrieval 
system capable of capturing packets or rows of 
video displayable data andor control program 
instructions from data continuously transmitted in a 
common predetermined format. In the system dis- 
closed in the patent, a user decides what informa- 
tion IS to be retrieved, and takes action to cause a 
terminal to retrieve that information. Although a 
user can vary the function of the terminal by cap- 
turing different transmitted data, it is the user that 
determines what video displayable information is to 
be received, and how the terminal which receives 
this information is to process it. There is no disclo- 
sure or provision of means to enable a system 
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operator to establish the functional operation of 
individual terminals on a multi-terminal network 

In commonly owned U.S. Patent 4.712 239 to 
Frezza. et al. entitled "Security Arrangement for 
Downloadable Cable Television Converters" incor- 
porated herein by reference, a downloadable con- 
verter is disclosed that prevents a false booter 
image from being downloaded. A false image could 
subject the system to various integrity problems 
such as enabling an unauthorized user to view 
premium programs. In the patented system a 
booter image is received on one channel and a 
checksum is computed there from. A valid check- 
sum, extracted from tag data transmitted on a 
separate channel and associated with a scrambled 

rZlT 'T^' '"'"^^'■'^ computed 
checksum. If the checksums do not match, a de- 
scrambler in the converter is precluded from de- 

V*"^ "Th^ system dis- 

closed in this patent downloads all of the operating 

=°"^^«er over a 
dedicated "booter channel", to which the converter 
IS force tuned when first turned on. After the down- 
load IS complete, the converter's data receiver is 
returned to the regular data channel, where it re- 
mains until the converter is turned off. 

It would be advantageous to provide a method 
and system for downloading firmware to a remote 
terminal, such as a cable television converter to 
allow modification of virtually any or all firmware 
functions of the terminal by the system operator It 
would be further advantageous for such a method 
and system to enable the system operator to re- 
place or modify options that were predetermined at 
the time of manufacture or installation of the termi- 
nal. By effecting terminal modifications automati- 
cally from a headend location, such a method and 
system would eliminate the need for a technician to 
travel to a subscriber's home to modify or phys- 
ically replace a subscriber's terminal to effect such 
functional modifications. 

The present invention provides such a method 
and system for remotely modifying the functionality 
of a cable television converter or other terminal. 

SUIVIMAnv OF THE INVENTION 



In accordance with the present invention, a 
cable television converter with remotely modifiable 
functionality is provided. The converter includes 
means for receiving firmware downloaded over a 
cable television network, and means coupled to the 
receiving means for storing the firmware. Means 
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are provided for verifying the integrity o' t^e firm- 
ware and processor means coupled to the sU)nng 
:::;s accesses and executes t^e ~ P^^; 
vide one or more converter functions d.ctated Dy 
ItVe firr^w are. NonvolaUle memory means are coup- 
S to The processor means for storing default 

I cnwware for the converter. Means re- 
operation software roi mo n,nrp<;- 

sponsive to the verifying means cause the proces 
so^ means to execute the default operation soft- 
ware, instead of the downloaded firmware in the 
even! the integrity of the firmware is not ve fied. 

Data receiving means may be P^°^'d^^ jj! 
obtaining instructions downloaded over a cabte 
etvision network. Downloaded firrnware is re- 
ceived and stored by the , °f ^ J3 
sponse to specific instructions received by the data 

receiving means. rsceiv- 
The firmware receiving means and data rece^v 
ing means can comprise a frequency agile data 
?ceiver. together with means for selec^ve V tu "^^^ 
the receiver, to receive instructions on a first chan 
ne^ and downloaded firmware on a -or^^^^^^^^^^^^^^^^^ 
Timer means return the receiver to the first channel 
; the receiver has been tuned to the second c^a 
nel for a predetermined time period. The predeter 
mined time period may be specified -n .ns rue ons 
deceived on said first channel, and the length of the 
r^; period may be dependent on an amount of 
firmware to be received. In this manner, a con 
Lrt^r will not become stuck on the second c anne 
by error, and be rendered unable to receive further 
instructions on the first channel. 

The downloaded firmware received and stored 
by the converter can implement a functional layout 
on a keyboard associated with the converter. Firm- 
ware can also implement a feedback function such 
as an LED (light-emitting-diode) display or on- 
screen display to assist a user in operating the 
converter. A control function for a video recorder 
coupL to the converter can also be ^^^"^^^ 
by the firmware. Similarly, the firmware can imple- 
ment a communication protocol for the converter a 
descrambimg technique for the converter a,^ on^ 
screen display to be provided by the converter to a 
television coupled thereto, and/or a user interface 
lo se^ces provided over the cable television net- 

' """'"in a preferred embodiment of the present in- 
vention, firmware is transmitted - an encwted 
form, and the instructions contain a key for decryp 
ting the firmware. The firmware may also be re- 
eled by the converter in a plurality of segr^ents. 
with the instructions identifying the number of seg- 
ments to be received for a complete firmware 
ZIL Means can be provided det— 
if all of the segments have been vahd y eceived 
and for receiving replacement segments if one or 
more segments of the firmware have not been 



validly received. Receipt of firmware can be pre- 
vemed if the number of segments identified by the 
instructions is greater than a predetermined limit^ 
Cable television headend apparatus is provided 
5 for downloading firmware to an addressable re • 
motely modifiable cable television converter. 
Means are provided for transmitting ad ressable 
converter data on a first data channel of a cab e 
television network. Means are Provided fo titans 
,0 mitting firmware on a second data channe of the 
cable television network. An address specific to a 
pfrtic^converter is provided in the addressabe 
converter data, which enables specific data to be 
Sed by the converter. Instructions are provided 
,5 n ^e specific data, to cause the converter to 
receive firmware transmitted on the second chan- 

"^'"The cable television headend apparatus can 
further include means for verifying that firmware 
.0 downloaded to the converter has been success u V 
received by the converter. Billing means maintain 
records of the cable television services each con_ 
lerter on the system is authorized to receive, and . 
various functions the converter is to have^and 
« can assign a particular firmware, package to be 
" downSded to a particular converter on the basis 
of the functions specified for that converter. 

A method for providing a cable television con- 
verter with functions dictated by 
30 ware is also provided. Converter control d^^- is 
received from a remote location via a cable telev^^ 
Jon network. A designated firmware package is 
captured from a set of firmware Packages carried 
on the cable television network, m response to 
35 nstructions contained in the converter con tro ta^ 
The designated firmware package is stored in a 

memory provided in the ^onve^-'/^JJ ^^^^^^^ 
to provide at least one converter function dictated 

,0 ""'"he firmware packages may be carried on the 
cable television network in encrypted form, and 
dec^p^ed using a key contained in the converte 
conS data. In one embodiment, the converter 
cont^ data is received on a first data channel and 
. he^lware packages are captured «rom a -^^^^^^ 
data channel on the cable television network. The 
SSchannel is monitored to receive converter con- 
ro data and the second channel is tuned to cap- 
"retmware upon receipt of appropria^ -tr^ ; 
50 tions on the first channel. Reception is retu med to 
the first channel after the firmware is captured. If 
The firmware has not been -Ptured with, a pr - 
determined time period, reception switched back to 
the first channel from the second channel. 

Also in accordance with the present inventK)n^ 
a remotely modifiable user terminal is provided 
'wh'h comVises means for receiving a plurality 0 
cyclically transmitted firmware segments, the seg 
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ments together comprising a firmware package 
Means coupled to the receiving means verify each 
segment upon receipt thereof, and means are pro- 
vided for storing each verified segment. A deter- 
mination is made as to whether a complete firm- 
ware package has been stored in the storing 
means at the completion of a firmware transmission 
cycle. If not, then reception, verification, and stor- 
age of transmitted firmware segments continues 
during a subsequent firmware transmission cycle 
Reception of the firmware segments is terminated 
upon a finding that a complete firmware package 
has been stored. Means can further be provided for 
precluding the execution of firmware segments un- 
til a complete firmware package has been stored. 

The verifying means can operate by testing a 
checksum for each firmware segment as it is re- 
ceived. The temiinal may further comprise means 
for maintaining a record of the proper checksum for 
each segment, and means for periodically retesting 
the checksums after a complete firmware package 
has bean stored. Default operation software may be 
stored for the terminal, and executed if the check- 
sums are not verified upon retesting. The complete 
firmware package may also be verified after it has 
been stored, and the default operation software 
executed if the complete firmware package is not 
valid. The default operation software may also be 
executed if reception of firmware segments is not 
completed during a predetermined time period. 

A complete firmware package may include a 
plurality of modules. Execution of fewer than all of 
the modules may be precluded as an additional 
security feature. 



DETAILED DESCRIPTION OF THE INVENTION 



BRIEF DESCRIPTIOfyj OF THE DRAWINGS 

Figure 1 is a block diagram of a functionally 
modifiable cable television converter system in ac- 
cordance with the present invention; 

Figure 2 is a block diagram of the pertinent 
elements of a converter used In connection with 
the system of the present invention; 

Figure 3 is a flowchart illustrating steps tak- 
en by the headend when it receives a new firm- 
ware package or an assignment to download firm- 
ware to a converter; 

Figure 4 is a flowchart illustrating the con- 
tinuous transmission of firmware over a secondary 
data channel; 

Figure 5 is a flowchart illustrating the steps 
taken by a converter in receiving downloaded firm- 
ware; and 

Figure 6 is a flowchart illustrating the peri- 
odic reverification of downloaded software by a 
converter. 



Turning to Figure 1. a cable television system 
5 IS depicted having headend comoonents. generally 
designated 10 and subscriber comoonenfs, gen- 
erally designated 12. The headend communicates 
with the subscriber via a distribution cable 36 A 
firmware development system 16 is used to create 
10 new functional firmware packages for subscriber 
terminals, such as converter 40. Firmware develop- 
ment system 16 may be physically located at the 
headend, but is more typically located at the facili- 
ties of a vendor which develops new firmware 
75 programs for sale to a cable system operator New 
firmware packages may be transferred to an ad- 
dressable controller 14 located at the headend by 
magnetic tape 20 which is read by addressable 
controller 14, or by communication between the 
20 firmware development system 16 and addressable 
controller 14 via direct connection or modems 18 
operating over conventional telephone lines Those 
skilled in the art will recognize that other means 
may also be available tor transferring firmware from 
25 firmware development system 16 to addressable 
controller 14. 

Once firmware is resident in addressable con- 
troller 14, it is transmitted repeatedly over a data 
channel. The data channel may be either the pri- 
30 mary addressable data channel provided in a con- 
ventional cable television network having addres- 
sable converters, or a separate secondary data 
channel. In either event, the data channel(s) can 
transmit the data on an FSK modulated FM carrier 
35 or by any other suitable transmission scheme well 
known in the art. 

The use of a secondary channel for down- 
loading firmware to converters is illustrated in Fig- 
ure 1. Control signals, including data such as con- 
40 verier addresses, program authorization codes and 
the like IS communicated from addressable control- 
ler 14 to a converter 40 via control data modulator 
26. The output of control data modulator 26 is 
coupled to distribution cable 36 via a tap 34 and 
15 data is received therefrom by converter 40 via tap 
38. The control data modulator transmits the data 
signals on a primary channel, and in accordance 
with the present invention, the data includes 
instructions to converter 40 which cause the con- 
so yerter to receive specified firmware downloaded 
from addressable controller 14. 

In the two channel embodiment illustrated in 
Figure 1, the firmware is transmitted on a secon- 
dary channel by firmware modulator 24, coupled to 
55 the cable network at tap 30. Upon receipt of 
instructions on the primary channel, converter 40 
switches to the secondary channel for- receipt of 
designated firmware. An additional data path 28 
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o^ay optionally be provided via tap 32 for rece p o 
data from cor^verter 40 by addressable controlle 
14 Such data trilght include, for example, a ver 
cation that converter 40 has successfully received 
a firmware package it has been mstructed to re 
ceive The provision of a return path 28, which 
provides a "two-way" cable communication sys- 
tem, is well known in the art. 

Billing system 22 is provided at the headend 
for maintaining accounting information rela ing to 
charges incurred by subscribers on the cable sys- 
tem In accordance with the P'^^^^' 
ferent firmware packages downloaded by headend 

0 to converter 40 may provide different converter 
functions, with higher levels of service providing 
increased converter functionality. Billing system 22 
keeps track of the level or service 'o^.^^ch 
scriber, and assigns particular firmware packages 
?o subscriber converters on the basis of converter 
functionality to be provided to each subscnber 

At the subscriber location 12, a subscriber may 
have one or more video appliances 42. 44 coupled 
to the output of converter 40. For example video 
appliance 42 might be a television set and video 
appliance 44 might be a video recorder ( VCR ) Jn 
accordance with the present invention, irmwa e 
downloaded to converter 40 can Prov'de ^uncUons 
relaUng to a VCR. An example of such a function is 

1 controlled programming. This function enab es 
the converter to be programmed to ^^^""^ 
Changes at various times so that tl^^/^ere^t 
record different television programs on different 
channels automatically and while unattended. Such 
a function can also enable "impulse Pav-Pf-^; 
orders to be programmed into the converter by a 
subscriber, so that special premium programs can 
be ordered, when the subscriber is not home, and 
recorded on the subscriber's VCR for later viewing. 

Fioure 2 is a block diagram illustrating the 
pertinent components in one embodiment of a con- 
verter 40 in accordance with the present mvention. 
,n the embodiment illustrated, the converter re- 
ceives addressable data on one data channel and 
downloaded firmware on another data channel. It is 
noted that in another embodiment of the invention 
both the addressable data and the firmware can be 
deceived over a single data channel. Or. the fjrm- 
ware may be carried on some other media, such as 
the public telephone network. 

in the two channel embodiment illustrated in 
Figure 2, a microprocessor 50 receives data from 
cable 36 via a frequency agile receiver 52^ A 
transmitter 61 and return path 62 can be provided 
from microprocessor 50 back to addressable con- 
troller 14 in the event the converter is used with a 
two-way cable television system. Like receiver 52 
transmitter 61 can be frequency agile to enable a 
choice of return transmission frequencies. 



A tuner 54, under the control of microprocessor 
50, tunes frequency agile- receiver 52 ^oj^^'^ 
primary channel for receipt of ^f^^^'^^^f;^ 
(eq instructions to capture a particular firmware 
5 oa^kage) or to a secondary channel for the receipt 
' oSware. Although a single secondary channel i 
described herein for purposes of i""Stration it w H 
be appreciated that any number of such secondary 
Channels can be provided, depending on system 
,0 requirements. Typically, frequency agile receiver 
WIN be tuned to the primary channel, and wiH only 
switch to the secondary channel upon spe i c 
instructions contained in data received on the first 
channel. In the alternate embodiment where both 
,5 addressable data and firmware received on a 
single data channel, frequency agile receiver 52 
and tuner 54 can be replaced with a fixed fre- 
auency data receiver. 

The provision of a dedicated secondary data 
20 Channel as illustrated in Figure 2 is advantageous. 
By keeping firmware data oH of the pnmary chan- 
oel. the data throughput load on this channel is 

'^"Tn^fhe two Channel embodiment, firmware data 
25 is broadcast cyclically on the second channel by 
addressable controller 14 at the. headend, n a 
pit d embodiment, a plurality of different^^m- 
ware packages are broadcast on the secondary 
' Channel, each package providing f-ent convert 
30 er functions or combinations of f^n^t'°"^;JJP°" 
receipt of instructions on the Pr""ary chan e^ 
microprocessor 50 will cau(e tuner 54 to sw. ch 
leiver 52 to the secondary channel for receipt of ^ 
a desianated firmware package. 
35 various memory devices are coupled to micro- 
processor 50. including read only memory 
TROM") 56. operating random access memon^ 
"RAM" 58, and nonvolatile firmware RAM 60. 
ROM 56 contains a program that allows converter 
40 to retrieve and execute a downloaded firmware 
° Package Spon receiving the proper command from 
Si addressable controller, the converter aborts any 
downloaded package currently being executed, ac- 
Tssel the appropriate data channel for receipt of a 
^ desSna ed firmware package to be downloaded, 
and receives and loads the firmware into non- 
volatile firmware RAM 60. 

ROM 56 also contains default operation soft- 

ware, which is used to restore 
so nominal or "baseline" operation if a bad firmware 
download occurs. As explained below, if an error ,s 
Sed in the receipt of downloaded firmware, or 
ffte firmware is found to be invalid, the converter 
Is forced to execute only the default operation 
software stored in ROM 56. 

A timer 64 is associated with microprocessor 
50 to Tovide a time-out feature that prevents the 
onvertTf om getting stuck on the secondary 
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channel, in the event there is a problem receiving 
specified firmware. 

When billing system 22 assigns a new firm- 
ware package to a particular converter 40, addres- 
sable controller 14 is commanded to transmit 
instructions to the converter. The instructions are 
received by microprocessor 50. and include an 
Identifier specifying which firmware package to re- 
ceive, where to find the firmware package (ie on 
the primary or a specified secondary channel) a 
predetermined time limit defining how long the 
converter should attempt to receive the firmware 
before aborting, a key to use in decrypting the data 
>n the event it is encrypted, and the maximum 
segment number to be loaded (indicating how 
many segments are included in the firmware pack- 
age to be received). While the firmware is being 
received, timer 64 counts down the time-out period 
specified in the download command. If the timer 
expires, microprocessor 50 aborts the download 
and returns to the original data channel. The time- 
out period specified in the download command can 
be varied depending on the amount of firmware to 
be downloaded.- 

Timer 64 is also used in connection with a self- 
check that is periodically jDerformed by the con- 
verter to ensure that the firmware has not changed 
since the last authorized download. This self-check 
IS a security feature to guard against infiltration of 
the converter by a "software pirate" who attempts 
to download unauthorized software to the converter 
in an effort to steal services from the cable system ' 
In accordance with the self-check procedure 
timer 64 retests the checksum for each of the 
firmware segments at regular intervals after the 
firmware has been downloaded. In the event a 
checksum is found to be invalid, microprocessor 50 
restores the converter to baseline operation by 
executing the default operation software contained 
in ROM 56. 

Converter 40 contains various other compo- 
nents with functions that can be modified by down- 
loaded firmware. For example, a light-emitting-di- 
ode {'LED") display or other display 66 may be 
provided on the converter to give a user feedback 
concerning converter operations. Pressing a button 
on the converter, or its remote control unit can 
cause an LED to light, verifying that the button has 
been pressed or that a function to be activated by 
the button has occurred. Such a feedback function 
IS useful to assist a user in operating the converter. 

The converter also includes a keyboard 68 the 
functional layout of which can be defined ar^d/or 
modified by firmware downloaded to the converter 
Keyboard 68 may be physically on the converter 
box, on a remote hand-held unit for the converter 
or a separate keyboard can be provided in both 
places. 



Converter 40 also includes a descrambler 70 
for descrambling premium programs received via 
the cable television network. Various descrambling 
techniques are well known in the art, and different 
5 techniques can be implemented by downloading 
different firmware to the converter. 

Another feature that can be provided by con- 
verter 40 is the display of information on a user's 
television set. On-screen display driver 72 is pro- 
'0 vided for this purpose. An example of such a 
display is the channel number tuned to. or the 
current time. In addition, on-screen displays can be 
used to distribute messages from the cable system 
operator, e.g.. "your account is past due; please 
'5 send us a check". An electronic mail, or "E-mail- 
feature can also be provided, enabling a subscriber 
to send and receive text messages on his televi- 
sion (or other display) via the cable system The 
implementation and/or modification of on-screen 
20 displays can be provided by firmware downloaded 
to the converter. 

In order to provide a measure of protection 
against illegal use of the, firmware download fea- 
ture, the firmware is downloaded to the converter in 
25 an encrypted form. The data is decrypted at the 
converter by a decryption module 74. A decryption 
key IS transmitted to the converter from the 
headend as part of the addressable data Instruc- 
tions that command the converLer to receive a 
30 particular firmware package. Encryption and de- 
cryption schemes are well known in the art Exam- 
ples of such schemes are provided in commonlv 
owned U.S. Patent Nos. 4.638,356 of William A 
Frezza. entitled "Apparatus and Method for Re- 
35 stncting Access to a Communication Network" and 
4.710.955 of Marc W. Kauffman. entitled "Cable 
Television System with Two-Way Telephone Ccm- 
munication Path". Both of these patents are incor- 
porated herein by reference. 
^0 A viewership monitor 76 can be provided in 
accordance with the present invention to enable a 
cable system operator to determine what programs 
and services a subscriber has received using each 
converter. and,or to retrieve a list of the functions 
« which have been used on each converter. Viewer- 
ship monitor 76 will monitor the operation of the 
converter, and store pertinent data relating thereto 
By addressing an appropriate command to the 
converter, the cable system operator will be able to 
50 upload the data to the headend for analysis. 

Other functions that can be implemented by 
firmware downloaded to the converter include com- 
munication protocols for the converter, and user 
interfaces to services provided over the cable tele- 
55 vision network. For example, a user may be pro- 
vided with the capability to order pay-per-view pro- 
grams on an impulse basis. The procedure for 
ordenng such programs can be modified through 
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downloadable firmware. Utility '"^^^^ /^^'^"S 
also be provided, by adding an asynchronous data 
port to the converter and controlling the retneval of 
utilitv data via downloaded firmware. 

A flowchart illustrating a routine whtch can be 
used by the addressable controller in connection 
"th the receipt and downloading of firmware -s 
provided in F.gure 3. The routine begins at box 8^ 
and at box 82 a determination is "^a^^ ^ J° 
whether a firmware update has been received J - 
the firmware development system. If so, control 
nasses to box 84 and the new firmware data is 
enc ypted At box 86. the encrypted data is loaded 
fnto the secondary data channel transmitter 
Tmwar: modulator 24) and continuously transm - 
ed on the secondary channel together with other 
nrmware packages that can be provided lo convert- 
ers on the system. 

At box 88. a determination is made as lo 

whether a new firmware P^'^'^S^/^^'^^^^^^'^e 
been made by billing system 22. If so, addressable 
controller 14 sends an appropriate command on 
Ihe primary channel (control data modu^tor 26^^s 
indicated at box 90. The command is addressed to 
the particular converter that is to receive the f rn^^ 
ware and identifies the channel the firmware is to 
L deceived from, identifies the firmware package 
to be received, provides the decryption key neces- 
ary to d crypt the firmware data, identifies he 
. number of segments which make up the complete 
S^mware package, and sets forth the ..me-out P - 
rameter defining the maximum bme, the converge 
should stay tuned to the secondary channel for 
receipt of the downloaded firmware. 

The converter receives the firmware in fixed 
length "segments", and specific converter models 
iThave specific maximum segment numtjers d. 
termining the actual maximum size of allowable 
Lware downloads. In a Prf -d ernbod..^ t^ 
the maximum segment number is a hard-coded 
parameter. Should an attempt be -de Jo down^ 
Ld firmware that exceeds the maximum size, the 
download will be reiected by the converter^ in op 
" eration the converter will ignore the download 
corSmand and will not switch to the secondary 
chrnnel if the transmitted maximum segment num- 
ber parameter exceeds the Internal converter maxi- 

""""it box 92 of Figure 3. a determination is made 
as to whether an abort of a download is required. 
Thil would be the case, for example, if the addres- 
laSe controller detects a problem with an attempt- 
ed download, in the event an abort is required an 
abort command is transmitted over the secondary 
cSlel as indicated at box 94. The converter w H 
hen switch back to the primary channel, execute 
he default operation software to return to a 
. laseltl operln. and await a subsequent com- 



mand from the addressable controller via the pr^ 
ma^ data channel. At box 96, the routine of F,gure 
Tends. It will be appreciated by those skilled in the 
art that the routine of Figure 3 is called on a 
5 periodic basis (or can be a continuous loop) to 
enabte new firmware to be received from the firm- 
ware development system and to download f.m- 
ware packages to converters at the command of 

, "'"^igurSTiSstrates a routine that the addres- 
° sable controller can use to continuously transrn 
i^mware data over the secondary channel. The 
oZe commences at box 100, and at box 102 
data is transmitted over the secondary channe . A 
,5 box 104, a determination is made as to whether the 
last segment of a firmware package has been 
Lsmitted-lf not. transmission o' the remaining 
segments continues as indicated at box 102. Once 
hl^ast segment has been transmitted, con ro 
,0 passes to box 106 and the addressab^ contro le 
transmits a checWexecute command to the 
conver^^r(s) that was to receive the firmware pack- 
ace ^-e check/execute command includes the fir- 
mware package number that was to be receivecL 
2S Tnd a check pattern. The check pattern ,s used to 
Verify the entire download prior to executionjhen 
a check/execute command is received, the con 
verter checks to see if all required segments have 
been received, and that the check pattern down- 
30 loaded matches the pattern calculated from the 
actual downloaded data. If all checks are va d the 
Snverter permits execution of the own^ad^d 
code, and returns to the primary data channel 
After the check/execute command is sen at box 
« 106 of Figure 4. control returns to box 102, and 
Continuous transmission of the data proceeds over 

^^^^PreTisTihart illustrating the capture 
of downloaded firmware by a converter. The rou- 
.o L beqins at box 110, and control passes to box 
" 1 Sre a determina«on is made as to whet^her^a 
firmware capture command has been sen to the 
converter. H not, the converter cominucusy waits 
for such a command to be received at box 112. 
^ once a firmware capture command is received 
control passes from box 112 to box 120 for the 
actual capture of the firmware. At the same time. 
TtS time-out process commences as m- 
^ It hnxes 114 116, and 1 18. A timer counts 

caotu-e command. If ths "me-oot p.nM 

me «rm«.e ^ '"^"^^ 



7 



13 



EP 0 399 200 A2 



14 



appropriate firmware package can be properly 
downloaded. 

As indicated at box 120, before a firmware 
download commences, a determination is made a-^ 
to whether the number of segments contained in 
the firmware package to be downloaded is within 
bounds. In other words, as noted above, the maxi- 
mum segment number of the firmware pacl<age to 
be downloaded must not exceed the maximum size 
allowable for the converter. If the number of seg- 
ments exceeds the number allowed by the con- 
verier, the firmware capture command is ignored 
and control returns to box 112. Otherwise, the 
firmware capture proceeds and at box 122 the 
converter switches to the secondary channel ' (i.e., 
the channel on which the firmware is downloaded). 
At box 124, the segments comprising the firmware 
package are received. Firmware is continuously 
broadcast on the secondary data channel in small 
(e.g., 32 byte) encrypted packets. A converter that 
has been commanded to accept a new package 
tunes to the appropriate channel and loads each 
packet that has the proper version identifier. While 
loading, the converter keeps track of each segment 
successfully loaded in an internal segment bit map 
As indicated at box 126, a determination is made 
as to whether a segment has been successfully 
loaded. This is accomplished by computing a 
checksum for each segment, and comparing the 
checksum with one downloaded with the firmware 
segment. If the checksums match, the converter 
decrypts the data contained in the segment, stores 
the data, and sets an appropriate bit in a firmware 
segment bit map as indicated at box 130. In storing 
the data, if prior firmware has been stored in the 
converter, the appropriate segment of the prior 
firmware is overwritten with the newly received 
data. 

If it is determined at box 126 that a segment 
has not been properly loaded (i.e.. the computed 
and downloaded checksums do not match) the 
converter ignores the segment and proceeds di- 
rectly to box 132. At box 132, a determination is 
made as to whether the last segment in a firmware 
package has been received. If not, control returns 
to box 124 and the procedure continues until all 
segments are received. 

After the last segment has been received con- 
trol passes to box 134 which determines if the bit 
map created at box 130 is complete. If the bit map 
IS not complete, it means that one or more seg- 
ments were not properly loaded and an attempt to 
receive these segments will be made during the 
next transmission cycle of the firmware. In this 
event, control returns from box 132 to box 124 
where an attempt to receive the entire firmware 
package will again be made. 

As is evident from the flowchart of Figure 5. an 



incorrectly received segment will not overwrite a 
previously correctly received segment. All correctly 
received segments, however, will overwrite pre- 
viously received segments. In this manner, even if 
5 there are errors in the transmission of certain seg- 
ments during a download cycle, all of the segments 
should be correctly received after the completion of 
several complete transmission cycles of a firmware 
package. 

'0 Once all of the segments have been properly 
received, the bit map will be comolete, and box 
1 34 will pass control to box 136. Box 136 responds 
to the check-execute command transmitted by the 
addressable controller at box 106 in Figure 4 
's When the check-execute command is received the 
converter checks to see if all required segments 
have been received and that the check pattern 
downloaded matches a pattern calculated from the 
actual downloaded data (i.e., the complete firmware 
20 package). If the patterns do not match, control 
retums to box 124 and additional attempts are 
made to receive the firmware as long as a time-out 
(box 114) has not occurred. 

If the entire firmware package is determined to 
25 be valid at box 136, control passes to box 138 and 
an execution bit is set permitting the firmware to be 
executed. As an additional level of protection 
against a software pirate, software contained in the 
converter's ROM (ROM 56 - Figure 2) can periodi- 
30 cally determine if all of the functional modules 
contained in the firmware package are being ex- 
ecuted, and if not, subsequent execution of the 
firmware can be precluded by turning off a sepa- 
rate, special execution bit maintained by the con- 
as verter. 

At box 140, the downloading of a firmware 
package is complete, and the converter return- to 
the pnmary data channel. The routine ends at box 

"0 The firmware download process is a destruc- 
tive one. Once a converter receives the command 
to accept a new package, the old downloaded 
firmware (if any) is effectively deleted and cannot 
be executed. In the preferred embodiment, partial 
«5 downloads are not supported, and an entire pack- 
age must be sent. This further frustrates a software 
pirate's efforts, and allows a firmware download to 
be nullified by sending the command to accept a 
package immediately followed by sending the com- 
50 mand to return to the primary data channel. 

The various commands sent by the addres- 
sable controller to support the firmware download 
process are: 

Accept Firmware Download 
55 Return to Primary Channel 

Disallow Downloaded Execution 
Load Firmware Segment 
Check/Execute Firmware 
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Send Firmware Check Pattern 

The "Accept Firmware Download" command -s 
used to initiate the firmware download P'°«ss . « 
may be sent to one individual converter or globally 
Ta set of converters that understand a group 
address. The addressed converter(s) prepares o 
accept the package number, on the appropnate 
hannel. using the given firmware decjP °^;ey 
and maximum segment number. The frmware 
download time-out value is also given. Upon recep 
tion of this command, the converter goes m o its 
flware download mode, in which ,t must not 
execute any downloaded code. 

The "Return to Primary Channel" command ,s 
used to force a converter to return to the prjary 
data channel. This command may also be sent n a 
specific format to an individual converter, or m 
ormat to a set of converters. All converters 
Lelg this command abort the current f.« 
download, clear their firmware segment bit maps, 
and exit the firmware download mode. _ 
The "Disallow Dowloaded Execution com 
mand explicitly disallows the execution of any 
downloaded firmware. It may be sent in the specie 
or group format. All converters receiving this com 
Ind abort execution of any downloaded firmware, 
dear their firmware segment bit ^aps exit firm- 
ware download mode, and execute the default op- 
Tr^'on software contained in BOM for baseline 
operation.. Another method of P^o^J»'"9f^^"'°\'; 
e6 fim^ware from being executed ,s to send an 
"Accept Firmware Download" command immed 
ately followed by a "Return to Primary Channel 

'"The'-Load Firmware Segment" command is 
used to download the individual segments o a 
firmware package. All converters receiving th^s 
command, if in firmware reception mode overwr te 
the appropriate segment of firmware by the re- 
ceived data. Before actually overwriting the code, 
r nverter checks to see if the package number 
matches the commanded package "umber^ and 
calculates the segment check pattern 'rem the e^ 
ceived data. If the check pattern is correct, the 
sJgment data is decrypted, the appropnate prior 
segment is overwritten with the new segment and 
the appropriate bit in the firmware segment bit map 

"^The "Check/Execute Firmware" command is 
used to terminate the firmware download process^ 
S converters receiving this command respond 
only if the package number matches the one sent 
onginally in the "Accept Firmware 
mand and it in firmware reception mode. If so. the 
converter checks to see if all of the necessary 
segments of firmware have been correctly re- 
ceived If they have been, the package check pat- 
ens calculated and tested. If the check pattern is 



bad the converter ignores the command. If the 
Seek pattern is good, the converter permits execu- 
tion of *e newfy downloaded package, switches 
Sack to the primary data stream, exits the firmware 
5 download mode, and clears its firmware download 

^^^The'Cd Firmware Check Pattern" command 
is used to verify the firmware download process. A 
converter receiving this command responds only f 
,0 t is not in firmware reception mode, in this event, 
the converter reports the check pattern of the ap^ 
oropriate segment or of the entire package. This 
S»n scheme is only available on a two-way 

„ ""FiguJe^illustrates a periodic self-check routine 
used by the converter to test the validity of down- 
oaded firmware to ensure that it 
since the last download. This self-check is per- 
Smed by the converter itself, and "o adf ssab^^^ 
,0 controller command -is required to initiate it^ The 
Sutne begins at box 150. At box 152. a clock runs 
o keep track of time. At box 154. a determ.na..on 
s made as to whether a predetermined time -nte^ 
val has passed. If not. the routine loops back to 
.5 box 152 and the process continues until the time 
interval has run. Then, box 154 passes control to 
box 156 to commence the periodic self-check.. 

At box 156, the first segment of the firmware 
package is tested by computing its checksum. At 
.0 box 158 a determination is made as to whetfier the 
'° ch cksum is the proper checksum for tha seg- 
ment If not. control passes to box 160 and the 
deTault operation software is executed to return the 
converteTto baseline operation. If the checksum for 
35 the segment is proper, control passes to box 162^ 
" Which determines if the segment iust tested is the 
last segment in the firmware package. If not me 
routine loops back to box 156 so that all ^ the 
segments in the firmware package can tested 

Once the last segment has been tested, control 
;s pa°sS::m box ?62 to box 164 where the cloc 
is reset Control then loops back, to box 152 and 
he process continues, so that the self-chec w.l 
be periodically performed at the time .n erva^^dic. 
45 teted by the time-out determination function at box 

'^''it will now be appreciated that the present 
invention provides a method and apparatus for 
emS modifying the functionality of a ternjina . 
50 suTh as a cable television converter. Terminal func- 
.ons are dictated by downloaded frm-f^ 
firmware is transmitted in small segments to re- 
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packages may be carried on a single system, with 
different terminals in the system accepting and 
executing different packages as specified by the 
system headend. 

The firmware is stored at the terminal in non- 
volatile memory, such as RAM with a battery bac- 
kup, vanous safeguards are provided to ensure 
hat the firmware is accurately downloaded, and to 
frustrate the efforts of a software pirate attempting 
to infiltrate the system. 

Although the present invention has been de- 
scribed in connection with a preferred embodiment 
It will be appreciated that many modifications and 
adaptations may be made thereto without departino 
from the spirit and scope of the invention as set 
forth in the following claims. 



Claims 

1. A cable television converter with remotely 
modifiable functionality comprising: 
means for receiving firmware downloaded from a 
cable television headend; 

means coupled to said receiving means for storing 
said firmware; 

means for verifying the integrity of said firmware- 
processor means coupled to said storing means "for 
accessing and executing said firmware to provide 
one or more converter functions dictated bv the 
firmware; 

nonvolatile memory means coupled to said proces- 
sor means for storing default operation software for 
said converter; and 

means responsive to said verifying means for caus- 
ing said processor means to execute said default 
operation software instead of said firmware in the 
event the integrity of said firmware is not verified 

2. The converter of claim 1 further comprising- 
data receiving means for obtaining instructions 
downloaded from a cable television headend- and 
means for enabling downloaded firmware to be 
received and stored by the converter only in re- 
sponse to specific instructions received by said 
data receiving means. 

3. The converter of claim 2 wherein said firm- 
ware receiving means and data receiving means 
comprise; 

a frequency agile data receiver; and 
means for selectively tuning said receiver to re- 
ceive said instructions on a first channel and said 
firmware on a second channel. 

4. The converter of claim 3 further comprising- 
timer means for returning said receiver to said first 
channel if it has been tuned to said second channel 
for a predetermined time period. 

5. The converter of claim 4 wherein said pre- 
determined time period is specified in instructions 



received on said first channel. 

6. The converter of claim 5 wherein the length 
of said predetermined time period is dependent on 
an amount of firmware to be received. 
5 7. The converter as defined in one of claims 1- 

6 wherein said firmware implements a functional 
layout on a keyboard associated with said con- 
verter. 

8. The converter as defined in one of claims 1- 
'0 7 wherein said firmware implements a feedback 

function to assist a user in operating the converter 

9. The converter as defined in one of claims 1- 
8 wherein said firmware implements a control func- 
tion for a video recorder coupled to the converter 

's 10. The converter as defined in one of claims 

1-9 wherein said firmware implements a commu- 
nication protocol for the converter. 

11- The converter as defined m one of claims 
1-10 wherein said firmware implements a descram- 
20 bling technique for the converter. 

12. The converter as defined in one of claims 
1-11 wherein said firmware implements an on- 
screen display to be provided by the converter to a 
television coupled thereto. • 
25 13. The converter as defined in one of claims 
1-12 wherein said firmware implements a user in- 
terface to services provided over a cable television 
network. 

14. The converter as defined in one of claims 
30 1-13 wherein said firmware implements an elec- 
tronic mail capability to be provided over a cable 
television network. 

15. The converter as defined in one of claims 

1- 14 wherein said firmware implements a viewer- 
35 Ship monitoring function. 

16. The converter as defined in one of claims 

2- 15 wherein said firmware is transmitted in an 
encrypted form, and said instructions contain a key 
for decrypting the firmware. 

"0 17. The converter as defined in one of claims 
2-16 wherein said firmware is received in a plurality 
of segments, and said instructions identify the 
number of segments to be received for a complete 
firmware download. 

"5 18. The converter of claim 17 further compris- 
ing: F => 

means for determining if all of said segments have 
been validly received: and 
means for receiving replacement segments if one 
50 or more segments of said firmware has not been 
validly received. 

19. The converter as defined in one of claims 
17 or 18 further comprising: 

means for preventing the receipt of firmware if the 
55 number of segments identified by said instructions 
IS greater than a predetermined limit. 

20. A cable television converter with remotely 
modifiable functionality comprising: 
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frequency agile data receiver means for receipt of 
addressable data from a cable television hea end 
on a first channel and for receipt of f.rmware from 
said headend on a second channel; 
means for tuning said receiver means to sa.d sec 
end channel for receipt of firmware ^^SP°"^«J° 
instructions contained in addressable data rece.ved 
on said first channel; . 
memory means for storing firmware received on 
said second channel; and 

processor means coupled to said memory means 
for accessing and executing firmware received 
from said headend to provide at least one con- 

verter function. „„„„ric 

21. The converter of claim 20 further compns- 

means for verifying the integrity of firmware re- 
ceived on said second channel; and 
means for causing said processor "J^J"^ J" 
ecute default operation software instead of said 
f'mware in the event the integrity of said firmware 

is not verified. „i„:„,c 

22. The converter as defined in one of claims 

or 21 further comprising: 

timer means for returning said receiver to s^^^ j'^J 
channel if it has been tuned to said second channel 
for a predetermined lime period. . 

23 The converter of claim 22 wherein sa.d 
predetermined time period is specified in instruc- 
Lns contained in addressable data received on 

said first channel. ^ , . 

24 The converter as defined in one of claims • 
22 or 23 wherein the length of said predetermmed 
time period is dependent on the amount of firm- 

ware to be received. „,„i„e 

25 The converter as defined in one of claims 
20-24 wherein said firmware implements a func- 
tional layout on a keyboard associated with said 

2?^The converter as defined in one of claims 
20-24 wherein said firmware implements a feed- 
back function to assist a user in operating the 

g^The converter as defined in one of claims 
20-24 wherein said firmware implements a control 
function for a video recorder coupled to the con- 

''""zs The converter as defined in one of claims 
20-24 wherein said firmware implements a commu- 
nication protocol for the converter. 

29 The converter as defined in one of claims 
20-24 wherein said firmware implements a de- 
scrambling technique for the converter. 

30 The converter as defined in one of claims 
20-24 wherein said firmware -"^Pte-^^^tV^" °": 
screen display to be provided by the converter to a 
television coupled thereto. 

31. The converter as defined in one of claims 



20-24 wherein said firmware implements a user 
interface to services provided over a cable televi- 
sion network. 

32 The converter as defined in one of claims 
c 20-24 wherein said firmware implements an elec- 
tronic mail capability to be provided over a cable 
television network. * 

33 The converter as defined m one of claims 
20-24 wherein said firmware implements a viewer- 

10 ship monitoring function. 

34 Cable television headend apparatus for 
downloading firmware to an addressable remotely 
modifiable cable television converter, compnsing. 
means for transmitting addressable converter data 

,5 on a first data channel of a cable television net- 

rJans for transmitting firmware on a second data 
channel of said cable television network; 
means for providing an address in said addres- 
,0 sable converter data specific to a partK:uiar co " 
verter coupled to the network, said address en 
abS specific data to be received by said con- 
verter on said first data channel; and 
means for providing instructions in said specific 
,5 daT said instructions causing said converter to 
receive firmware transmitted on said second chan- 

■ 35. The apparatus of claim 34 further compris- 

30 means for verifying that firmware downloaded to 
rjd converter has been successfully received by 

S^Tt apparatus as defined in one of claims 
34 or 35 further comprising: 
35 billing means for maintaining a record of functions 
said 'converter is authorized to have, and for as- 
signing a particular firmware package to be down 
Sed to said converter on the basis of the au- 

n^^rmlthod for providing a cable television 
converter with functions dictated by downloaded 
firmware, comprising the steps of: 
Sing converter control data from 3 remote 
headend location; 
45 capturing a designated firmware package, from a 
To Lware packages transmitted from said 
demote headend location, in response to .nstruc- 
tions contained in said converter control data. 
Storing the designated firmware package in a mem- 
50 ory provided in said converter; and 

executing said firmware to provide at least one 
converter function dictated thereby. ^ „ 

38. The method of claim 37 v^^erem the fn^m- 
ware packages are transmitted in encrypted form, 

55 said method comprising the further step of. . 

decrypting the captured firmware using a key con- 
tained in said converter control data. 

39. The method as defined in one of claims 37 
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or 38 wherein said converter control data is re- 
ceived on a first channel of a cable television 
network and said firmware packages are captured 
from a second channel of the cable television net- 
work. 

40. The method of claim 39 comprising the 
further steps of: 

monitoring said first channel to receive converter 
control data: 

switching to said second channel to capture firm- io 
ware upon receipt of appropriate rnstructions on 
said first channel; and 

switching back to said first channel after said firm- 
ware is captured. - 

41- The method of claim 40 comprising the /s 
further step of: 

switching back to sard first channel from said sec- 
ond channel upon the expiration of a predeter- 
mined rime period, if the firmware has not been 
captured within said time period. 

42. The method of claim 41 comprising the 
further step of: 

deriving said time period from converter control 
data received on said first channel. 

43. The method as defined in one of claims 41 25 
or 42 wherein the length of the time period is 
dependent on the amount of firmware to be cao- 
tured. 

44. A remotely modifiable user terminal com- 
prising; 

30 

means for receiving a plurality of cyclically trans- 
mitted firmware segments together comprising a 
firmware package: 

means coupled to said receiving means for verify- 
ing each segment upon receipt thereof: 55 
means responsive to said verifying means for stor- 
ing each verified segment: 
means for determining if a complete firmware 
package has been stored in said storing means at 
the completion of a firmware transmission cycle- 40 
means responsive to said determining means' for 
continuing to receive, verify, and store transmitted 
firmware segments during a subsequent firmware 
transmission cycle if said determining means finds 
that a complete firmware package has not been 4s 
stored; and 

means for terminating the reception of firmware 
segments upon a finding by said determining 
means that a complete firmware package has been 
stored. 

45, The terminal of claim 44 further comprising- 
means for precluding the execution of firmware 
segments until a complete firmware package has 
been stored. 

46. The terminal as defined in one of claims 44 55 
or 45 wherein said verifying means tests a check- 
sum for each firmware segment, said terminal fur- 
ther comprising; 



means for maintaining a record of the proper chec- 
ksum for each segment; and 
means for periodically retesting said checksums 
after a complete firmware package has been 
stored. 

47. The terminal of claim 46 further comprising- 
means for storing default operation software for 
said terminal; and 

means for executing said default operation software 
if said checksums are not verified upon retesting. 

48. The terminal as defined in one of claims 
44-47 further comprising: 

means for validating the complete firmware pack- 
age after it has been stored. 

49. The terminal of claim 48 further comprising- 
means for storing default operation software for 
said terminal: and 

means for executing said default operation software 
If said validating^ means determines that the com- 
plete firmware package is not valid. 

50. The terminal as defined in one of claims 
44-49 further comprising: 

timer means for terminating the reception of firm- 
ware segments after a predetermined time period 

51. The terminal of claim 50 further comprising- 
means for storing default operation software for 
said terminal: and 

means for executing said default operation software 
If said timer means terminates the reception of 
firmware segments. 

52. The terminal as defined in one of claims 
44-51 wherein said terminal is a cable television 
converter, and the execution of said firmware pro- 
vides at least one converter function. 

53. The terminal as defined in one of claims 
44-52 wherein a complete firmware package in- 
cludes a plurality of modules, said terminal further 
comprising: 

means for precluding the execution of downloaded 
firmware if fewer than all of the modules are avail- 
able for execution. 



12 



EP 0 399 200 A2 




BP 0 399 200 A2 



or 



1 




O 

q: 



5^ 



V 



CO cc 
a: p 

i±i o 
> 2 



cr 
o 

CO 
(O 
LU 
O 

o 
a: 

Q. 

o 
q: 
o 



q: 

UJ 



UJ 

O o a 



Ul 

a! 

i 

q: 

UJ 

a 



s I 
sag 

crouj 
ijl<q: 



UJ 

-J 

CD 
< 



I 
I 
I 

|i 



q: 
< 
o 

CD 
>- 
UJ 



Ql 

S2 
o 



cr 
u 



JO 



EP 0 399 200 A2 



BEGIN y ^SO 





SEND COMMAND ON 
PRIMARY CHANNEL : 
-ID FIRMWARE CH. 

- 1 0 FIRMWARE PKG. 
-DECRYPTION KEY 

- NO. OF SEGMENTS 
-TIME OUT 



F/a3 



90 



TRANSMIT 
COMMAND OVER 
gprnNDAR Y CHANNEL 



94 



100 



TRANSMIT . 

DATA OVER 
SECONDARYCHANNa 



102 




104 



SEND CHECK /EXECUTE 
COMMAND : 
- PACKAGE NO. 
-CHECK PATTERN 



106 



EP 0 399 200 A2 



( BEGIN ^ 110 




SWITCH TO FIRMWARE 
CHANNEL 



RECEIVE NEXT 
SEGMENT 




STORE DATA AND 
UPDATE BIT MAP 




•132 



134 



YES 



T 1 

I NO ^^,^-114 
• TIMEOUT > 

I YES 

I ABORT DOWNLOAD AND~i .-//e 
' RETURN TO PRIMARY K 
[CHANNEL 

, J 

^ 

TeXECUTE DEFAULT 1 ,-//<? 
I OPERATION SOFTWARE f 

' — — — ——— —___J 




SET EXECUTION 
BIT 



RETURN TO 
PRIMARY CHANNEL 



f endU'/ 



/40 



EP 0 399 200 A2 



C BEGIN y ^'^^ 

3l 



[^RUN CLOCK ^^ '52 




160 



EXECUTE DEFAULT 
OPERATION SOFTWARE 



^^''P^QB Blank iuspto) 



Europaisches Patentamt 
European Patent Office 
Office europeen des brevets 





0 Publication number: 



0 399 200 A3 



® 



0 Application number: 90107108.4 
@ Date of filing: 12.04.90 



EUROPEAN PATENT APPLICATION 

® lnt.Ci.5:H04N 7/16 



(g) Priority: 25.05.89 US 357174 

@ Date of publication of application: 
28.11.90 Bulletin 90/48 

® Designated Contracting States: 

AT BE CH DE DK FR GB IT LI NL SE 

@ Date of deferred publication of the search report: 
08.07.92 Bulletin 92/28 



787 Fiftli Averiue 
New Yorit New York 1 01 53(US) 

@ Inventor: Kauffman, Marc W. 
420 Franklin Avenue 
Cheltenham, Pennsylvania 19012(US) 
Inventor: Miller, Michael R. 
98 Onieda Avenue 
Moorestown, New Jersey 08057(US) 

© Representative: Hoeger, Stellrecht & Partner 
Uhiandstrasse 14 c 
W-7000 Stuttgart 1(DE) 




© A cable television converter with rennotely modi- 
fiable functionality receives firmware downloaded 
over a cable television network. The integrity of the 
firmware is verfied and if valid, the firmware is ex- 
ecuted to provide one or more converter funtions. If 
the firmware is invalid, default operation software 
contained in ROM is executed instead of the firm- 
ware to return the converter to baseline operation. In 
one embodiment, the converter Includes a frequency 
agile data receiver to receive control instructions on 



a first data channel and firmware on a second data 
channel. The receiver is forced back to the first 
channel if a successful firmware download does not 
occur on the second channel within a predetermined 
time period. The firmware is continuously transmit- 
ted In short segments, and the converter can con- 
tinue to receive segments until all the segments of a 
designated firmware package have been success- 
fully downloaded, unless the predetermined time lim- 
it expires sooner. 
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